Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

ABTV //

Vulnerability

End of Bibblio RCM includes -->
1/19/2018
09:05 AM
Larry Loeb
Larry Loeb
Larry Loeb

Spectre Can Obfuscate Tracking Tools, Too

As the security community learns more about the Spectre vulnerability, clever coders are already finding other exploits. Here's looking at the first of many.

Those doggone programmers. Give them a massive bug and they figure out a way to make it work for them.

Now, if you don't have a programming or geek bone in your body then what follows may seem to be completely impenetrable. You may leave and go sit down with some cocoa without taunts. This isn't for everyone.

OK kids, Mom and Dad out of the room? Let's start.

Serge Guelton was the guy to first figure this out regarding the Spectre vulnerability, and I draw heavily on his blog for the code that illustrates this technique. In fact, to avoid any possible mis-attribution, as well as changes to that code that may occur in the future, I would encourage everyone to check the blog for the actual code that is involved in this. (See New Intel Vulnerability Hits Almost Everyone.)

(Source: Pixabay)
(Source: Pixabay)

Spectre, at the most basic, allows the reading of a memory location on a vulnerable CPU without actually referencing or accessing that location in a programming sense. It can do this on any location, whether protected or not, and that is what is causing all the problems. (See Security Warning: Intel Inside.)

The function that Guelton came up with extends the proof of concept code.

It will first perform a copy from src -- the original program code -- to mem -- the temporary copy that you are making -- to make sure the address is not located on the stack. It will then go on to use the Spectre vulnerability to make a "shadow" copy from mem to dest, where the programmer can manipulate it.

Guelton's function shadow_memcpy uses a global hidden state -- which is the memory cache -- in order to transfer data from one buffer to another one. This hidden state is invisible to tracking tools, and with this technique there is no data dependency existing between src and dest.

The first sneaky trick that can be done with it is an opaque predicate. Data is injected by shadow_memcpy into the predicate Boolean function, but calls to it will always return true -- no matter what data is injected.

This will also work for storing a function pointer, rather than some value. This extends the utility of shadow_memcpy to wrap all sorts of function calls in its protection.

Tracing tools will usually track the use of any register that has been marked as being a symbolic value. They then will try to reconstruct the instructions in a backwards manner. But use of shadow_memcpy will stop this from happening, blocking the tracking tool.

So, what you have, effectively, is a way to hide what you are doing from most tracking tools.

Now, shadow_memcpy may fail in use. It's a timing attack, and multithreaded applications may throw that timing off. Not only that, someone may analyze the treated code by hand and find a pattern that they can recognize. So, this method is not infallible.

However, we are seeing how a bug or flaw can be used by clever programmers to affect others parts of the system or infrastructure. Such cleverness can only be more prevalent as time goes on and we learn more about how vasbt the Spectre vulnerability is.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Incorporating a Prevention Mindset into Threat Detection and Response
Threat detection and response systems, by definition, are reactive because they have to wait for damage to be done before finding the attack. With a prevention-mindset, security teams can proactively anticipate the attacker's next move, rather than reacting to specific threats or trying to detect the latest techniques in real-time. The report covers areas enterprises should focus on: What positive response looks like. Improving security hygiene. Combining preventive actions with red team efforts.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-31650
PUBLISHED: 2022-05-25
In SoX 14.4.2, there is a floating-point exception in lsx_aiffstartwrite in aiff.c in libsox.a.
CVE-2022-31651
PUBLISHED: 2022-05-25
In SoX 14.4.2, there is an assertion failure in rate_init in rate.c in libsox.a.
CVE-2022-29256
PUBLISHED: 2022-05-25
sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only at `npm install` time when installing versions of `sharp` prior to the latest v0.30.5. If an attacker has the ability to set the value of the `PKG_CONFIG_PATH` e...
CVE-2022-26067
PUBLISHED: 2022-05-25
An information disclosure vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted series of network requests can lead to arbitrary file read. An attacker can send a sequence of requests to trigger this vulnera...
CVE-2022-26077
PUBLISHED: 2022-05-25
A cleartext transmission of sensitive information vulnerability exists in the OAS Engine configuration communications functionality of Open Automation Software OAS Platform V16.00.0112. A targeted network sniffing attack can lead to a disclosure of sensitive information. An attacker can sniff networ...